feat(tools): serve local images/video for Flex preview via LINE_FLEX_MCP_ASSET_DIR - #7
Merged
Merged
Conversation
…MCP_ASSET_DIR Add opt-in local media serving to the Flex preview server so a Flex message can reference artwork by a relative url during preview, then swap only the origin for the production HTTPS URL later (relative path stays 1:1). - Serve files under LINE_FLEX_MCP_ASSET_DIR; disabled unless configured. - Served set matches what LINE renders in a Flex message: JPEG/PNG (APNG is .png) images and .mp4 for the video component. GIF/WebP intentionally excluded. The video component renders its previewUrl poster in the preview (LINE app behavior); the mp4 url also resolves for consistency. - Confinement: extension allowlist, full-path normalization + under-base Ordinal check (rejects ../, backslash, rooted/UNC), control-char reject, and symlink physical containment via File.ResolveLinkTarget. - Loopback-host guard (same axis as /api DNS-rebinding defense); read-only safe (no LINE API, no secrets). renderer.js unchanged (parity preserved). Tests: pure-function confinement (traversal/rooted/symlink/uppercase-ext), content-type mapping, and loopback e2e (image + video/mp4 + encoded path + raw-socket non-normalized traversal). Tools tests 131/131, 0 warnings. 3-role gate (code/security/test-arch) = PASS, no blocking; findings applied. Record: docs/reviews/2026-09-04-flex-preview-local-image-serving-review.md Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Bump Line.OpenApi.Tools <Version> 1.2.0 -> 1.3.0 (minor: additive feature). - Add CHANGELOG (en/ja) [1.3.0] entry for LINE_FLEX_MCP_ASSET_DIR local image/video serving. Publish is a separate cadence: after merge to main, push tag tools-v1.3.0 to trigger release.yml publish-tool (OIDC/Trusted Publishing). Verified locally: dotnet pack yields Line.OpenApi.Tools.1.3.0.nupkg (+snupkg), DotnetTool command `line`, 0 warnings. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
Flex プレビューサーバ（
Line.OpenApi.Tools）に、環境変数LINE_FLEX_MCP_ASSET_DIRで指定したフォルダ内のメディアファイルを配信する機能を追加します。利用シーン: 用意した画像/動画をフォルダに配置 → Flex JSON からは相対
url（例"assets/hero.png"）で参照 → 本番移行時は origin だけ HTTPS の CDN/ホストに差し替える（相対パス部分は不変＝1:1 マッピング）。あくまでプレビュー用の利便機能（LINE 本体はローカル URL もdata:URL もレンダリングしない）。配信対象（LINE Flex 実仕様に準拠）
.png）.mp4（type:"video"コンポーネント）video コンポーネントは renderer が
previewUrl（JPEG/PNG のポスター）＋▶ で描画し mp4 本体は取りに行かない（LINE アプリと同じ挙動）。プレビュー表示は previewUrl 配信で足りるが、mp4 のurlも相対参照で解決可能にした。renderer.jsは無改修（web assets parity 維持）。セキュリティ（多層防御）
LINE_FLEX_MCP_ASSET_DIR未設定なら完全無効・404）。ディレクトリは人が out-of-band 設定＝LLM 非制御（AIFunction スキーマに露出しない）image/*・video/mp4・octet-stream に限定Path.GetFullPath正規化 → ベース配下 Ordinal 判定（../・..\・%2e%2e・%5c・rooted/UNC を捕捉）＋制御文字拒否File.ResolveLinkTarget）/apiと同軸の DNS リバインド対策）／read-only 安全（LINE API 非呼び出し・シークレット非保持）3 役ゲート
code-reviewer / security-reviewer / test-arch-reviewer = すべて PASS・BLOCKING なし。収束指摘（シンボリックリンク越え・e2e トラバーサルのクライアント正規化退化・content-type 未網羅）を反映済み。記録:
docs/reviews/2026-09-04-flex-preview-local-image-serving-review.mdテスト・検証
Line.OpenApi.Tools.Tests131/131 緑・ビルド 0 警告video/mp4・エンコードパス・raw ソケット非正規化トラバーサル）/tools支援ティア内の HTTP プレビュー機能。生成コード・R1 ルーティング・公開 API snapshot・Kiota 版ピンに非接触（pack 12 パッケージ契約は Tools 除外で不変）変更ファイル
tools/Line.OpenApi.Tools/Services/FlexPreviewService.cstests/Line.OpenApi.Tools.Tests/FlexPreviewAssetServingTests.cs（新規）tools/README.md/tools/README_ja.mddocs/reviews/2026-09-04-flex-preview-local-image-serving-review.md🤖 Generated with Claude Code